fix: 消除 buildOrderStatusUrl 重复定义，修复轮询回调引用稳定性

- 将 buildOrderStatusUrl 提取到 status-url.ts（客户端安全模块），
  删除 OrderStatus/PaymentQRCode/result 三处重复定义
- OrderStatus.tsx 轮询 effect 使用 useRef 保存 onStateChange，
  避免非 memoized 回调导致定时器不断重建
- result/page.tsx 增加 accessToken 最小长度校验，
  避免无效参数触发无意义的 API 请求

src/components/PaymentQRCode.tsx

@@ -10,6 +10,7 @@ import {
   getPaymentIconSrc,
   getPaymentChannelLabel,
 } from '@/lib/pay-utils';
+import { buildOrderStatusUrl } from '@/lib/order/status-url';
 import { TERMINAL_STATUSES } from '@/lib/constants';
 
 interface PaymentQRCodeProps {
@@ -36,15 +37,6 @@ function isVisibleOrderOutcome(data: PublicOrderStatusSnapshot): boolean {
   return data.paymentSuccess || TERMINAL_STATUSES.has(data.status);
 }
 
-function buildOrderStatusUrl(orderId: string, statusAccessToken?: string): string {
-  const query = new URLSearchParams();
-  if (statusAccessToken) {
-    query.set('access_token', statusAccessToken);
-  }
-  const suffix = query.toString();
-  return suffix ? `/api/orders/${orderId}?${suffix}` : `/api/orders/${orderId}`;
-}
-
 export default function PaymentQRCode({
   orderId,
   token,